1001fdf77dfa3f34ae1a7e6d32776dcdd94365dc4785a8b82e96834c9d0f60bd | Triage

Analysis

max time kernel
1769s
max time network
1781s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 14:57

Sharing

Report Analysis Logs

General

Target

Celestial Rat/server/start.bat
Size

37B
MD5

4d04aeb048cd4e89bf1b6718824ec5a2
SHA1

621e1ae4a7d7901e34e61f6e7fa90b8ad89af0de
SHA256

409dffb5444c2630541f7d539effeeae3df3ed993b4dba2a5e60d8940548b1d1
SHA512

99c18b9c6a397c4033a2dde8fdc1fa13b9d5a685d50548358651d617c42b059b8f772d7e34dc1769ae546e11229b19185a4fd93ce2753567ead51a999365fb40

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3004	844	cmd.exe	81
PID 844 wrote to memory of 3004	844	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Celestial Rat\server\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files\dotnet\dotnet.exe
  dotnet Server.dll 3333 P@SSw0rd
  2⤵
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads